---
id: CVE-2026-118986
title: >-
  CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a
  signing secret generated with rand()
summary: >-
  CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a
  signing secret generated with rand().


  The secret that signs session cookies is built from two calls to the built-in
  rand(), which is seeded with 32 bits. The…
severity: none
cwe:
  - CWE-338
product: CallBackery
affected:
  - CallBackery < 0.62.0
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T13:13:32.845Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118986'
references:
  - url: 'https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes'
tags:
  - cve.org
epss: 0.00158
epssPercentile: 0.04962
ingestedAt: '2026-11-05T16:07:30.238Z'
---

## Overview

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand().

The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline.

An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.

## Affected

- `CallBackery < 0.62.0`

## Remediation

Upgrade to CallBackery 0.62.0 or later.